Skip to content

Commit 7d06b92

Browse files
navaneethsnair1navaneethsnair1
authored
Merge pull request #4494 from OpenLiberty/staging
Update prod
2 parents e7b66d8 + a811052 commit 7d06b92

2 files changed

Lines changed: 187 additions & 4 deletions

File tree

‎blog_tags.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"blog_tags": [
33
{
44
"name": "announcements",
5-
"posts": ["25.0.0.8", "25.0.0.7",
5+
"posts": ["25.0.0.9-beta", "25.0.0.8", "25.0.0.7",
66
"25.0.0.7-beta", "25.0.0.6",
77
"25.0.0.6-beta", "25.0.0.5",
88
"25.0.0.4", "25.0.0.4-beta",
@@ -187,7 +187,7 @@
187187
},
188188
{
189189
"name": "release",
190-
"posts": ["25.0.0.8", "25.0.0.7",
190+
"posts": ["25.0.0.9-beta", "25.0.0.8", "25.0.0.7",
191191
"25.0.0.7-beta", "25.0.0.6",
192192
"25.0.0.6-beta", "25.0.0.5",
193193
"25.0.0.4", "25.0.0.4-beta",
@@ -259,7 +259,7 @@
259259
},
260260
{
261261
"name": "beta",
262-
"posts": ["25.0.0.7-beta", "25.0.0.6-beta",
262+
"posts": ["25.0.0.9-beta", "25.0.0.7-beta", "25.0.0.6-beta",
263263
"25.0.0.4-beta", "25.0.0.3-beta",
264264
"25.0.0.2-beta", "25.0.0.1-beta",
265265
"24.0.0.12-beta", "24.0.0.11-beta",
@@ -311,7 +311,7 @@
311311
},
312312
{
313313
"name": "security",
314-
"posts": ["25.0.0.3", "25.0.0.3-beta",
314+
"posts": ["25.0.0.9-beta", "25.0.0.3", "25.0.0.3-beta",
315315
"25.0.0.2", "25.0.0.1-beta",
316316
"24.0.0.12", "zero-migration",
317317
"24.0.0.10-beta", "liberty-olo-rh-sso",

‎posts/2025-08-26-25.0.0.9-beta.adoc‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
---
2+
layout: post
3+
title: "Support for FIPS 140-3 with IBM Semeru in 25.0.0.9-beta"
4+
# Do NOT change the categories section
5+
categories: blog
6+
author_picture: https://avatars3.githubusercontent.com/navaneethsnair1
7+
author_github: https://github.com/navaneethsnair1
8+
seo-title: Support for FIPS 140-3 with IBM Semeru in 25.0.0.9-beta - OpenLiberty.io
9+
seo-description: Federal Information Processing Standards (FIPS) are standards and guidelines for non-military U.S. government computer systems, contractors, and agencies. In this release, you can set up Liberty to comply with the FIPS 140-3 standard when you use certain IBM Semeru Runtimes JDKs.
10+
blog_description: Federal Information Processing Standards (FIPS) are standards and guidelines for non-military U.S. government computer systems, contractors, and agencies. In this release, you can set up Liberty to comply with the FIPS 140-3 standard when you use certain IBM Semeru Runtimes JDKs.
11+
open-graph-image: https://openliberty.io/img/twitter_card.jpg
12+
open-graph-image-alt: Open Liberty Logo
13+
---
14+
= Support for FIPS 140-3 with IBM Semeru in 25.0.0.9-beta
15+
Navaneeth S Nair <https://github.com/navaneethsnair1>
16+
:imagesdir: /
17+
:url-prefix:
18+
:url-about: /
19+
//Blank line here is necessary before starting the body of the post.
20+
21+
Federal Information Processing Standards (FIPS) are standards and guidelines developed by the National Institute of Standards and Technology (NIST) for non-military U.S. government computer systems, contractors, and agencies. In this release, you can set up Liberty to comply with the FIPS 140-3 standard when you use certain IBM Semeru Runtimes JDKs.
22+
23+
// // // // // // // //
24+
// Change the RELEASE_SUMMARY to an introductory paragraph. This sentence is really
25+
// important because it is supposed to grab the readers attention. Make sure to keep the blank lines
26+
//
27+
// Throughout the doc, replace 25.0.0.9-beta with the version number of Open Liberty, eg: 22.0.0.2-beta
28+
// // // // // // // //
29+
30+
* <<fips, FIPS 140-3 support on IBM Semeru>>
31+
32+
See also link:{url-prefix}/blog/?search=beta&key=tag[previous Open Liberty beta blog posts].
33+
34+
// // // // DO NOT MODIFY THIS COMMENT BLOCK <GHA-BLOG-TOPIC> // // // //
35+
// Blog issue: https://github.com/OpenLiberty/open-liberty/issues/32410
36+
// Contact/Reviewer: jimmy1wu
37+
// // // // // // // //
38+
[#fips]
39+
== FIPS 140-3 support on IBM Semeru
40+
41+
FIPS 140-3 is the latest version of the FIPS 140 standard, which provides a set of guidelines for cryptographic modules to ensure their security and integrity. Support for FIPS 140-3 was first introduced in Liberty with IBM JDK 8 in version link:https://openliberty.io/blog/2025/03/25/25.0.0.3.html[25.0.0.3]. In this release, Open Liberty supports the FIPS 140-3 standard when using link:https://developer.ibm.com/languages/semeru-runtimes[IBM Semeru Runtimes] versions 11.0.27, 17.0.15, 21.0.7, or higher.
42+
43+
FIPS 140-3 is enabled when:
44+
45+
- Security features utilizing cryptographic algorithms are used
46+
- FIPS 140-3 Semeru JVM properties are set
47+
48+
If you installed IBM Semeru Runtimes, you can enable FIPS 140-3 by setting the following system properties, for example in the `jvm.options` file:
49+
50+
----
51+
-Dcom.ibm.ws.beta.edition=true
52+
-Dsemeru.fips=true
53+
-Dsemeru.customprofile=OpenJCEPlusFIPS.FIPS140-3
54+
----
55+
56+
The `OpenJCEPlusFIPS.FIPS140-3` profile is the strict security profile that is defined by IBM Semeru Runtimes, as outlined in the link:https://www.ibm.com/support/pages/fips-140-3-cryptography-ibm-semeru-runtimes#:~:text=FIPS140%2D3%20restricted%20security%20mode%20profile[official documentation]. This profile enforces the use of only FIPS 140-3 approved cryptographic algorithms, along with non-cryptographic algorithms that are either explicitly permitted or unrelated to the FIPS 140-3 specification.
57+
58+
Depending on your specific use case, you may need to apply additional constraints by link:https://www.ibm.com/support/pages/fips-140-3-cryptography-ibm-semeru-runtimes#:~:text=Creating%20extensions%20of%20profiles[creating an extension of the profile]. For instance, if your application uses PKCS12 as the TLS certificate keystore and truststore, you will need to define a custom profile that includes support for PKCS12.
59+
60+
For more information about how to extend the strict profile to accommodate PKCS12-based configurations, see the link:https://www.ibm.com/support/pages/fips-140-3-cryptography-ibm-semeru-runtimes#:~:text=PKCS12%20and%20JKS%20Example[PKCS12 and JKS Example section] of the FIPS 140-3 cryptography solution in IBM Semeru Runtimes IBM support page.
61+
62+
To support functionality beyond the default `OpenJCEPlusFIPS.FIPS140-3` profile, you must update your custom profile with additional constraints. Carefully review the constraints to ensure compliance with the FIPS 140-3 specification for your specific use case.
63+
64+
The following example shows how additional constraints have been added. The additional constraints allow for PKCS12 keystore usage and SHA-1 usage for the `org.objectweb.asm.commons.SerialVersionUIDAdder` and `org.eclipse.persistence.internal.libraries.asm.commons.SerialVersionUIDAdder` classes. Your constraints may vary depending on your usage or services.
65+
66+
----
67+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-myCustom.desc.name = My Custom OpenJCEPlusFIPS Cryptographic Module FIPS 140-3
68+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-myCustom.extends = RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3
69+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-myCustom.jce.provider.2 = sun.security.provider.Sun [+ \
70+
{KeyStore, PKCS12, *, ModuleAndFullClassName:java.base/java.security.KeyStore}, \
71+
{MessageDigest, SHA-1, *, FullClassName:org.objectweb.asm.commons.SerialVersionUIDAdder}, \
72+
{MessageDigest, SHA-1, *, FullClassName:org.eclipse.persistence.internal.libraries.asm.commons.SerialVersionUIDAdder}]
73+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-myCustom.jce.provider.4 = com.sun.crypto.provider.SunJCE [ \
74+
{AlgorithmParameters, PBES2, *, ModuleAndFullClassName:java.base/sun.security.pkcs12.PKCS12KeyStore}, \
75+
{AlgorithmParameters, PBEWithHmacSHA256AndAES_256, *, ModuleAndFullClassName:java.base/sun.security.pkcs12.PKCS12KeyStore}, \
76+
{SecretKeyFactory, PBEWithMD5AndDES, *, ModuleAndFullClassName:java.base/sun.security.pkcs12.PKCS12KeyStore}, \
77+
{Cipher, PBEWithHmacSHA256AndAES_256, *, ModuleAndFullClassName:java.base/sun.security.pkcs12.PKCS12KeyStore}, \
78+
{Mac, HmacPBESHA256, *, ModuleAndFullClassName:java.base/sun.security.pkcs12.PKCS12KeyStore}]
79+
----
80+
81+
A separate file is used to define the custom profile in the example, which is the recommended approach for link:https://www.ibm.com/support/pages/fips-140-3-cryptography-ibm-semeru-runtimes#:~:text=Creating%20extensions%20of%20profiles[creating extensions of profiles] in IBM Semeru Runtimes.
82+
83+
To activate the custom profile, the file must be appended to the `java.security` configuration by using the `-Djava.security.properties` system property. The custom profile in this example is named `OpenJCEPlusFIPS.FIPS140-3-myCustom` and extends the strict `OpenJCEPlusFIPS.FIPS140-3` profile.
84+
85+
The following `jvm.options` should be used to use the `OpenJCEPlusFIPS.FIPS140-3-myCustom` custom profile:
86+
87+
----
88+
-Dcom.ibm.ws.beta.edition=true
89+
-Dsemeru.fips=true
90+
-Djava.security.properties=< path-to-your-customprofile-file >
91+
-Dsemeru.customprofile=OpenJCEPlusFIPS.FIPS140-3-myCustom
92+
----
93+
94+
For more information, see link:https://www.ibm.com/support/pages/fips-140-3-cryptography-ibm-semeru-runtimes[FIPS 140-3 cryptography solution in IBM Semeru Runtimes].
95+
96+
// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC>
97+
98+
[#run]
99+
=== Try it now
100+
101+
To try out these features, update your build tools to pull the Open Liberty All Beta Features package instead of the main release. The beta works with Java SE 21, Java SE 17, Java SE 11, and Java SE 8.
102+
// // // // // // // //
103+
// In the preceding section:
104+
// Check if a new non-LTS Java SE version is supported that needs to be added to the list (21, 17, 11, and 8 are LTS and will remain for a while)
105+
// https://openliberty.io/docs/latest/java-se.html
106+
//
107+
// In the following section:
108+
// Check if a new MicroProfile or Jakarta version is in beta that could replace the example values in the codeblock
109+
// // // // // // // //
110+
111+
If you're using link:{url-prefix}/guides/maven-intro.html[Maven], you can install the All Beta Features package using:
112+
113+
[source,xml]
114+
----
115+
<plugin>
116+
<groupId>io.openliberty.tools</groupId>
117+
<artifactId>liberty-maven-plugin</artifactId>
118+
<version>3.11.4</version>
119+
<configuration>
120+
<runtimeArtifact>
121+
<groupId>io.openliberty.beta</groupId>
122+
<artifactId>openliberty-runtime</artifactId>
123+
<version>25.0.0.9-beta</version>
124+
<type>zip</type>
125+
</runtimeArtifact>
126+
</configuration>
127+
</plugin>
128+
----
129+
130+
You must also add dependencies to your `pom.xml` file for the beta version of the APIs that are associated with the beta features that you want to try. For example, the following block adds dependencies for two example beta APIs:
131+
132+
[source,xml]
133+
----
134+
<dependency>
135+
<groupId>org.example.spec</groupId>
136+
<artifactId>exampleApi</artifactId>
137+
<version>7.0</version>
138+
<type>pom</type>
139+
<scope>provided</scope>
140+
</dependency>
141+
<dependency>
142+
<groupId>example.platform</groupId>
143+
<artifactId>example.example-api</artifactId>
144+
<version>11.0.0</version>
145+
<scope>provided</scope>
146+
</dependency>
147+
----
148+
149+
Or for link:{url-prefix}/guides/gradle-intro.html[Gradle]:
150+
151+
[source,gradle]
152+
----
153+
buildscript {
154+
repositories {
155+
mavenCentral()
156+
}
157+
dependencies {
158+
classpath 'io.openliberty.tools:liberty-gradle-plugin:3.9.4'
159+
}
160+
}
161+
apply plugin: 'liberty'
162+
dependencies {
163+
libertyRuntime group: 'io.openliberty.beta', name: 'openliberty-runtime', version: '[25.0.0.9-beta,)'
164+
}
165+
----
166+
167+
Or if you're using link:{url-prefix}/docs/latest/container-images.html[container images]:
168+
169+
[source]
170+
----
171+
FROM icr.io/appcafe/open-liberty:beta
172+
----
173+
174+
Or take a look at our link:{url-prefix}/downloads/#runtime_betas[Downloads page].
175+
176+
If you're using link:https://plugins.jetbrains.com/plugin/14856-liberty-tools[IntelliJ IDEA], link:https://marketplace.visualstudio.com/items?itemName=Open-Liberty.liberty-dev-vscode-ext[Visual Studio Code] or link:https://marketplace.eclipse.org/content/liberty-tools[Eclipse IDE], you can also take advantage of our open source link:https://openliberty.io/docs/latest/develop-liberty-tools.html[Liberty developer tools] to enable effective development, testing, debugging and application management all from within your IDE.
177+
178+
For more information on using a beta release, refer to the link:{url-prefix}docs/latest/installing-open-liberty-betas.html[Installing Open Liberty beta releases] documentation.
179+
180+
[#feedback]
181+
== We welcome your feedback
182+
183+
Let us know what you think on link:https://groups.io/g/openliberty[our mailing list]. If you hit a problem, link:https://stackoverflow.com/questions/tagged/open-liberty[post a question on StackOverflow]. If you hit a bug, link:https://github.com/OpenLiberty/open-liberty/issues[please raise an issue].

0 commit comments

Comments
 (0)